@kensio/yulin 1.21.2 → 1.21.4

package/dist/service/s3/command/delete-object-tagging/delete-object-tagging.handler.js

@@ -0,0 +1,42 @@
+import { SimS3ObjectTagSet } from "../../object/s3-object-tags.js";
+import { SimS3ObjectTaggingAccess, } from "../tagging/sim-s3-object-tagging-access.js";
+/**
+ * Simulated S3 DeleteObjectTaggingCommand handler.
+ *
+ * https://docs.aws.amazon.com/AWSJavaScriptSDK/v3/latest/client/s3/command/DeleteObjectTaggingCommand/
+ */
+export class DeleteObjectTaggingCommandHandler {
+    access;
+    constructor(properties) {
+        this.access = new SimS3ObjectTaggingAccess(properties);
+    }
+    /**
+     * Take every tag off an Object, or off the version the request named.
+     *
+     * Real S3 removes the whole tag set and answers the same way whether or not
+     * the Object was carrying one, so an Object nobody had tagged is not an
+     * error. The event is raised either way, because the request is what real S3
+     * raises it for.
+     */
+    async handle(command, options) {
+        const { bucket, taggable, caller } = await this.access.reach({
+            commandName: "DeleteObjectTaggingCommand",
+            action: "s3:DeleteObjectTagging",
+            input: command.input,
+        }, options);
+        const object = await taggable.retag(SimS3ObjectTagSet.empty());
+        this.access.notifications.objectTagged({
+            bucket,
+            object,
+            caller,
+            eventName: "s3:ObjectTagging:Delete",
+            versionId: taggable.versionId,
+        });
+        return {
+            ...(taggable.versionId !== undefined && {
+                VersionId: taggable.versionId,
+            }),
+            $metadata: {},
+        };
+    }
+}

package/dist/service/s3/command/encryption/sim-s3-encryption-authorizer.d.ts

@@ -0,0 +1,29 @@
+import type { SimIamInterServiceAuthZ } from "../../../iam/authorize/sim-iam-inter-service-auth-z.js";
+import type { SimS3Bucket } from "../../bucket/sim-s3-bucket.js";
+import type { SimS3RequestOptions } from "../sim-s3-request-options.js";
+interface SimS3EncryptionAuthorizerProperties {
+    readonly iam: SimIamInterServiceAuthZ;
+}
+/**
+ * Applies IAM authorization to the S3 Bucket encryption commands.
+ *
+ * Two actions for three commands. Real S3 governs both applying and removing a
+ * default encryption configuration with s3:PutEncryptionConfiguration, since
+ * removing one is applying the default in its place.
+ */
+export declare class SimS3EncryptionAuthorizer {
+    private static readonly readAction;
+    private static readonly writeAction;
+    private readonly iam;
+    constructor(properties: SimS3EncryptionAuthorizerProperties);
+    /**
+     * Ensure the caller may read the Bucket's default encryption.
+     */
+    authorizeRead(bucket: SimS3Bucket, options?: SimS3RequestOptions): void;
+    /**
+     * Ensure the caller may change the Bucket's default encryption.
+     */
+    authorizeWrite(bucket: SimS3Bucket, options?: SimS3RequestOptions): void;
+    private authorize;
+}
+export {};

package/dist/service/s3/command/encryption/sim-s3-encryption-authorizer.js

@@ -0,0 +1,49 @@
+import { SimIamAccessDenied } from "../../../iam/error/sim-iam.error.js";
+import { simS3BucketArn } from "../../bucket/sim-s3-bucket-arn.js";
+import { simS3BucketResourcePolicies } from "../authorize/sim-s3-bucket-resource-policies.js";
+import { simS3ConditionContext } from "../authorize/sim-s3-condition-context.js";
+/**
+ * Applies IAM authorization to the S3 Bucket encryption commands.
+ *
+ * Two actions for three commands. Real S3 governs both applying and removing a
+ * default encryption configuration with s3:PutEncryptionConfiguration, since
+ * removing one is applying the default in its place.
+ */
+export class SimS3EncryptionAuthorizer {
+    static readAction = "s3:GetEncryptionConfiguration";
+    static writeAction = "s3:PutEncryptionConfiguration";
+    iam;
+    constructor(properties) {
+        this.iam = properties.iam;
+    }
+    /**
+     * Ensure the caller may read the Bucket's default encryption.
+     */
+    authorizeRead(bucket, options) {
+        this.authorize(SimS3EncryptionAuthorizer.readAction, bucket, options);
+    }
+    /**
+     * Ensure the caller may change the Bucket's default encryption.
+     */
+    authorizeWrite(bucket, options) {
+        this.authorize(SimS3EncryptionAuthorizer.writeAction, bucket, options);
+    }
+    authorize(action, bucket, options) {
+        const resource = simS3BucketArn(bucket.bucketName);
+        const decision = this.iam.authorize({
+            action,
+            resource,
+            caller: options?.caller,
+            conditionContext: simS3ConditionContext(options),
+            resourcePolicies: simS3BucketResourcePolicies(bucket),
+        });
+        if (decision.isDenied) {
+            throw new SimIamAccessDenied({
+                principal: decision.caller.principal,
+                reason: decision.denialReason,
+                action,
+                resource,
+            });
+        }
+    }
+}

package/dist/service/s3/command/encryption/sim-s3-encryption-commands.d.ts

@@ -0,0 +1,22 @@
+import type { SimS3BucketCommandState } from "../sim-s3-bucket-command-state.js";
+import type * as simS3Commands from "../sim-s3-command.types.js";
+import type { SimS3RequestOptions } from "../sim-s3-request-options.js";
+/**
+ * The default encryption commands of one simulated S3 scope.
+ */
+export declare class SimS3EncryptionCommands {
+    private readonly state;
+    constructor(state: SimS3BucketCommandState);
+    /**
+     * Apply a Bucket's default encryption.
+     */
+    put(command: simS3Commands.SimPutBucketEncryptionCommand, options?: SimS3RequestOptions): Promise<simS3Commands.SimPutBucketEncryptionCommandOutput>;
+    /**
+     * Read a Bucket's default encryption.
+     */
+    get(command: simS3Commands.SimGetBucketEncryptionCommand, options?: SimS3RequestOptions): Promise<simS3Commands.SimGetBucketEncryptionCommandOutput>;
+    /**
+     * Put a Bucket back to the encryption every Bucket has.
+     */
+    delete(command: simS3Commands.SimDeleteBucketEncryptionCommand, options?: SimS3RequestOptions): Promise<simS3Commands.SimDeleteBucketEncryptionCommandOutput>;
+}

package/dist/service/s3/command/encryption/sim-s3-encryption-commands.js

@@ -0,0 +1,30 @@
+import { DeleteBucketEncryptionCommandHandler } from "../delete-bucket-encryption/delete-bucket-encryption.handler.js";
+import { GetBucketEncryptionCommandHandler } from "../get-bucket-encryption/get-bucket-encryption.handler.js";
+import { PutBucketEncryptionCommandHandler } from "../put-bucket-encryption/put-bucket-encryption.handler.js";
+/**
+ * The default encryption commands of one simulated S3 scope.
+ */
+export class SimS3EncryptionCommands {
+    state;
+    constructor(state) {
+        this.state = state;
+    }
+    /**
+     * Apply a Bucket's default encryption.
+     */
+    async put(command, options) {
+        return await new PutBucketEncryptionCommandHandler(this.state).handle(command, options);
+    }
+    /**
+     * Read a Bucket's default encryption.
+     */
+    async get(command, options) {
+        return await new GetBucketEncryptionCommandHandler(this.state).handle(command, options);
+    }
+    /**
+     * Put a Bucket back to the encryption every Bucket has.
+     */
+    async delete(command, options) {
+        return await new DeleteBucketEncryptionCommandHandler(this.state).handle(command, options);
+    }
+}

package/dist/service/s3/command/get-bucket-encryption/get-bucket-encryption.command.d.ts

@@ -0,0 +1,24 @@
+import type { SimResponseMetadata } from "../../../aws/metadata/response-metadata.type.js";
+import type { SimS3ServerSideEncryptionConfiguration } from "../../bucket/encryption/sim-s3-bucket-encryption.js";
+/**
+ * Minimal structural sim S3 GetBucketEncryption command.
+ */
+export interface SimGetBucketEncryptionCommand {
+    readonly input: SimGetBucketEncryptionCommandInput;
+}
+/**
+ * Minimal structural sim S3 GetBucketEncryption input.
+ */
+export interface SimGetBucketEncryptionCommandInput {
+    readonly Bucket?: string | undefined;
+}
+/**
+ * Minimal structural sim S3 GetBucketEncryption output.
+ *
+ * A Bucket nobody has configured answers with the SSE-S3 rule real S3 applies
+ * to every Bucket, rather than with an error.
+ */
+export interface SimGetBucketEncryptionCommandOutput {
+    readonly ServerSideEncryptionConfiguration?: SimS3ServerSideEncryptionConfiguration;
+    readonly $metadata: SimResponseMetadata;
+}

package/dist/service/s3/command/get-bucket-encryption/get-bucket-encryption.command.js

@@ -0,0 +1 @@
+export {};

package/dist/service/s3/command/get-bucket-encryption/get-bucket-encryption.handler.d.ts

@@ -0,0 +1,31 @@
+import type { CommandHandler } from "../../../../command/command-handler.js";
+import { type BackgroundScheduler } from "../../../../util/background/background.js";
+import { type SimIamInterServiceAuthZ } from "../../../iam/authorize/sim-iam-inter-service-auth-z.js";
+import type { SimS3Bucket, SimS3BucketName } from "../../bucket/sim-s3-bucket.js";
+import type { SimS3RequestOptions } from "../sim-s3-request-options.js";
+import type { SimGetBucketEncryptionCommand, SimGetBucketEncryptionCommandOutput } from "./get-bucket-encryption.command.js";
+interface GetBucketEncryptionHandlerProperties {
+    readonly buckets: Map<SimS3BucketName, SimS3Bucket>;
+    readonly iam?: SimIamInterServiceAuthZ;
+    readonly background?: BackgroundScheduler;
+}
+/**
+ * Simulated S3 GetBucketEncryptionCommand handler.
+ *
+ * https://docs.aws.amazon.com/AWSJavaScriptSDK/v3/latest/client/s3/command/GetBucketEncryptionCommand/
+ */
+export declare class GetBucketEncryptionCommandHandler implements CommandHandler<SimGetBucketEncryptionCommand, SimGetBucketEncryptionCommandOutput> {
+    private readonly buckets;
+    private readonly authorizer;
+    private readonly background;
+    constructor(properties: GetBucketEncryptionHandlerProperties);
+    /**
+     * Authorize and report a Bucket's default encryption.
+     *
+     * A Bucket nobody has configured answers with the SSE-S3 rule rather than an
+     * error, which is what real S3 has answered since it began encrypting every
+     * Bucket by default.
+     */
+    handle(command: SimGetBucketEncryptionCommand, options?: SimS3RequestOptions): Promise<SimGetBucketEncryptionCommandOutput>;
+}
+export {};

package/dist/service/s3/command/get-bucket-encryption/get-bucket-encryption.handler.js

@@ -0,0 +1,39 @@
+import { BackgroundTasks, } from "../../../../util/background/background.js";
+import { assertDefined } from "../../../../util/type-guard/defined.js";
+import { SimIamAllowAllAuth, } from "../../../iam/authorize/sim-iam-inter-service-auth-z.js";
+import { SimS3EncryptionAuthorizer } from "../encryption/sim-s3-encryption-authorizer.js";
+import { requireSimS3Bucket } from "../require-sim-s3-bucket.js";
+/**
+ * Simulated S3 GetBucketEncryptionCommand handler.
+ *
+ * https://docs.aws.amazon.com/AWSJavaScriptSDK/v3/latest/client/s3/command/GetBucketEncryptionCommand/
+ */
+export class GetBucketEncryptionCommandHandler {
+    buckets;
+    authorizer;
+    background;
+    constructor(properties) {
+        const { buckets, iam = new SimIamAllowAllAuth(), background = new BackgroundTasks(), } = properties;
+        this.buckets = buckets;
+        this.authorizer = new SimS3EncryptionAuthorizer({ iam });
+        this.background = background;
+    }
+    /**
+     * Authorize and report a Bucket's default encryption.
+     *
+     * A Bucket nobody has configured answers with the SSE-S3 rule rather than an
+     * error, which is what real S3 has answered since it began encrypting every
+     * Bucket by default.
+     */
+    async handle(command, options) {
+        assertDefined(command.input.Bucket, "GetBucketEncryptionCommand.input.Bucket");
+        const bucketName = command.input.Bucket;
+        const bucket = requireSimS3Bucket(this.buckets, bucketName);
+        await this.background.sequence();
+        this.authorizer.authorizeRead(bucket, options);
+        return {
+            ServerSideEncryptionConfiguration: bucket.getEncryption().configuration,
+            $metadata: {},
+        };
+    }
+}

package/dist/service/s3/command/get-object/get-object-authorizer.d.ts

@@ -7,21 +7,24 @@ interface GetObjectAuthorizerProperties {
 /**
  * Applies IAM authorization to an S3 GetObject request.
  *
- * GetObject is authorized against the target Object ARN rather than the Bucket
- * ARN. An omitted caller is passed through to sim IAM so Account root fallback
- * behavior remains owned by IAM.
- *
- * The request's source ARN and source Account go in as condition keys, which is
- * what a Bucket policy written for a CloudFront origin access control is
- * conditioned on.
+ * A read is authorized against the target Object ARN. A read that finds
+ * nothing is authorized a second time, against the Bucket ARN, because real S3
+ * decides between AccessDenied and NoSuchKey on `s3:ListBucket`.
  */
 export declare class GetObjectAuthorizer {
-    private static readonly action;
     private readonly iam;
     constructor(properties: GetObjectAuthorizerProperties);
     /**
      * Ensure the caller may read the requested S3 Object.
      */
     authorize(bucket: SimS3Bucket, key: string, options?: SimS3RequestOptions): void;
+    /**
+     * Ensure the caller may be told that the Bucket holds no such key.
+     *
+     * Which keys a Bucket holds is what a listing tells you. Real S3 admits the
+     * absence only to a caller holding `s3:ListBucket` on the Bucket. Everyone
+     * else gets the same AccessDenied whether the key is there or not.
+     */
+    authorizeMissingKey(bucket: SimS3Bucket, options?: SimS3RequestOptions): void;
 }
 export {};

package/dist/service/s3/command/get-object/get-object-authorizer.js

@@ -1,18 +1,12 @@
-import { SimIamAccessDenied } from "../../../iam/error/sim-iam.error.js";
-import { simS3ConditionContext } from "../authorize/sim-s3-condition-context.js";
+import { simS3AuthorizeAction } from "../authorize/sim-s3-authorize-action.js";
 /**
  * Applies IAM authorization to an S3 GetObject request.
  *
- * GetObject is authorized against the target Object ARN rather than the Bucket
- * ARN. An omitted caller is passed through to sim IAM so Account root fallback
- * behavior remains owned by IAM.
- *
- * The request's source ARN and source Account go in as condition keys, which is
- * what a Bucket policy written for a CloudFront origin access control is
- * conditioned on.
+ * A read is authorized against the target Object ARN. A read that finds
+ * nothing is authorized a second time, against the Bucket ARN, because real S3
+ * decides between AccessDenied and NoSuchKey on `s3:ListBucket`.
  */
 export class GetObjectAuthorizer {
-    static action = "s3:GetObject";
     iam;
     constructor(properties) {
         this.iam = properties.iam;
@@ -21,30 +15,28 @@ export class GetObjectAuthorizer {
      * Ensure the caller may read the requested S3 Object.
      */
     authorize(bucket, key, options) {
-        const resource = `arn:aws:s3:::${bucket.bucketName}/${key}`;
-        const policy = bucket.getPolicy();
-        const decision = this.iam.authorize({
-            action: GetObjectAuthorizer.action,
-            resource,
-            caller: options?.caller,
-            conditionContext: simS3ConditionContext(options),
-            resourcePolicies: policy === undefined
-                ? []
-                : [
-                    {
-                        document: policy,
-                        policyName: "BucketPolicy",
-                        resourceArn: `arn:aws:s3:::${bucket.bucketName}`,
-                    },
-                ],
+        simS3AuthorizeAction({
+            iam: this.iam,
+            action: "s3:GetObject",
+            resource: `arn:aws:s3:::${bucket.bucketName}/${key}`,
+            bucket,
+            options,
+        });
+    }
+    /**
+     * Ensure the caller may be told that the Bucket holds no such key.
+     *
+     * Which keys a Bucket holds is what a listing tells you. Real S3 admits the
+     * absence only to a caller holding `s3:ListBucket` on the Bucket. Everyone
+     * else gets the same AccessDenied whether the key is there or not.
+     */
+    authorizeMissingKey(bucket, options) {
+        simS3AuthorizeAction({
+            iam: this.iam,
+            action: "s3:ListBucket",
+            resource: `arn:aws:s3:::${bucket.bucketName}`,
+            bucket,
+            options,
         });
-        if (decision.isDenied) {
-            throw new SimIamAccessDenied({
-                principal: decision.caller.principal,
-                reason: decision.denialReason,
-                action: GetObjectAuthorizer.action,
-                resource,
-            });
-        }
     }
 }

package/dist/service/s3/command/get-object/get-object-loader.d.ts

@@ -10,8 +10,8 @@ import type { SimGetObjectCommandOutput } from "./get-object.command.js";
  * This class owns both storage lookup and response conversion because the SDK
  * response is a representation of the stored Object:
  *
- * - a missing storage entry becomes the S3 NoSuchKey error, and a `VersionId`
- *   naming a version the Bucket never issued becomes NoSuchVersion;
+ * - a `VersionId` naming a version the Bucket never issued becomes
+ *   NoSuchVersion;
  * - the stored Buffer, or the part of it the read asked for, becomes the
  *   readable response body;
  * - what S3 was told about the Object becomes the response's own fields, and
@@ -25,6 +25,10 @@ export declare class GetObjectLoader {
     /**
      * Read an Object, or the range of it that was asked for, from the resolved
      * Bucket, and build its SDK command output.
+     *
+     * Answering `undefined` means the key holds nothing. The command handler
+     * turns that into the error the caller's permissions allow, which for a
+     * missing key is a decision of its own.
      */
-    load(bucket: SimS3Bucket, key: string, rangeHeader?: string, versionId?: string): Promise<SimGetObjectCommandOutput>;
+    load(bucket: SimS3Bucket, key: string, rangeHeader?: string, versionId?: string): Promise<SimGetObjectCommandOutput | undefined>;
 }

package/dist/service/s3/command/get-object/get-object-loader.js

@@ -1,6 +1,6 @@
 import { Readable } from "node:stream";
-import { SimS3NoSuchKey } from "../../error/sim-s3.error.js";
 import { simS3QuotedETag } from "../../object/s3-object-etag.js";
+import { simS3ObjectStorageReport } from "../../object/s3-object-storage-report.js";
 import { simS3ContentRange, simS3ReadObjectRange, } from "../../object/s3-object-range.js";
 import { simS3ReadObjectVersion } from "../object/sim-s3-read-object-version.js";
 /**
@@ -13,8 +13,8 @@ import { simS3ReadObjectVersion } from "../object/sim-s3-read-object-version.js"
  * This class owns both storage lookup and response conversion because the SDK
  * response is a representation of the stored Object:
  *
- * - a missing storage entry becomes the S3 NoSuchKey error, and a `VersionId`
- *   naming a version the Bucket never issued becomes NoSuchVersion;
+ * - a `VersionId` naming a version the Bucket never issued becomes
+ *   NoSuchVersion;
  * - the stored Buffer, or the part of it the read asked for, becomes the
  *   readable response body;
  * - what S3 was told about the Object becomes the response's own fields, and
@@ -28,11 +28,15 @@ export class GetObjectLoader {
     /**
      * Read an Object, or the range of it that was asked for, from the resolved
      * Bucket, and build its SDK command output.
+     *
+     * Answering `undefined` means the key holds nothing. The command handler
+     * turns that into the error the caller's permissions allow, which for a
+     * missing key is a decision of its own.
      */
     async load(bucket, key, rangeHeader, versionId) {
         const read = await simS3ReadObjectVersion(bucket, key, versionId);
         if (read === undefined) {
-            throw new SimS3NoSuchKey(`No S3 Object named ${key}`);
+            return undefined;
         }
         const object = read.object;
         const size = object.body.length;
@@ -51,6 +55,7 @@ export class GetObjectLoader {
             LastModified: object.lastModified,
             ContentLength: body.length,
             ...(read.versionId !== undefined && { VersionId: read.versionId }),
+            ...simS3ObjectStorageReport(object),
             ...read.lock?.reported,
             ...(range !== undefined && {
                 ContentRange: simS3ContentRange(range, size),

package/dist/service/s3/command/get-object/get-object.command.d.ts

@@ -1,6 +1,7 @@
 import type { Readable } from "node:stream";
 import type { SimResponseMetadata } from "../../../aws/metadata/response-metadata.type.js";
 import type { SimS3ObjectLockOutput } from "../../bucket/lock/sim-s3-object-lock-output.js";
+import type { SimS3ObjectStorageReport } from "../../object/s3-object-storage-report.js";
 import type { SimS3SystemMetadataOutput } from "../../object/s3-system-metadata-read.js";
 /**
  * Minimal structural sim S3 GetObject command.
@@ -41,7 +42,7 @@ export interface SimGetObjectCommandInput {
  * when it was written. `Metadata` is what the caller attached to it, and holds
  * nothing else.
  */
-export interface SimGetObjectCommandOutput extends SimS3SystemMetadataOutput, SimS3ObjectLockOutput {
+export interface SimGetObjectCommandOutput extends SimS3SystemMetadataOutput, SimS3ObjectLockOutput, SimS3ObjectStorageReport {
     readonly Body?: Readable;
     readonly Metadata?: Record<string, string>;
     readonly ETag?: string;

package/dist/service/s3/command/get-object/get-object.handler.d.ts

@@ -33,6 +33,10 @@ export declare class GetObjectCommandHandler implements CommandHandler<SimGetObj
      *
      * A stated `Range` reaches the loader with the key, since which bytes of an
      * Object a caller may read is not something IAM decides.
+     *
+     * A key holding nothing goes back to authorization before the absence is
+     * reported. Real S3 tells a caller that a key is missing only where it may
+     * list the Bucket, and answers AccessDenied otherwise.
      */
     handle(command: SimGetObjectCommand, options?: SimS3RequestOptions): Promise<SimGetObjectCommandOutput>;
 }

package/dist/service/s3/command/get-object/get-object.handler.js

@@ -1,7 +1,8 @@
 import { assertDefined } from "../../../../util/type-guard/defined.js";
-import { SimS3NoSuchBucket } from "../../error/sim-s3.error.js";
+import { SimS3NoSuchKey } from "../../error/sim-s3.error.js";
 import { BackgroundTasks, } from "../../../../util/background/background.js";
 import { SimIamAllowAllAuth, } from "../../../iam/authorize/sim-iam-inter-service-auth-z.js";
+import { requireSimS3Bucket } from "../require-sim-s3-bucket.js";
 import { GetObjectAuthorizer } from "./get-object-authorizer.js";
 import { GetObjectLoader } from "./get-object-loader.js";
 /**
@@ -33,18 +34,23 @@ export class GetObjectCommandHandler {
      *
      * A stated `Range` reaches the loader with the key, since which bytes of an
      * Object a caller may read is not something IAM decides.
+     *
+     * A key holding nothing goes back to authorization before the absence is
+     * reported. Real S3 tells a caller that a key is missing only where it may
+     * list the Bucket, and answers AccessDenied otherwise.
      */
     async handle(command, options) {
         assertDefined(command.input.Bucket, "GetObjectCommand.input.Bucket");
         assertDefined(command.input.Key, "GetObjectCommand.input.Key");
-        const bucketName = command.input.Bucket;
-        const bucket = this.buckets.get(bucketName);
-        if (bucket === undefined) {
-            throw new SimS3NoSuchBucket(`No S3 Bucket named ${bucketName}`);
-        }
+        const bucket = requireSimS3Bucket(this.buckets, command.input.Bucket);
         // Complete request sequencing before authorization and storage access.
         await this.background.sequence();
         this.authorizer.authorize(bucket, command.input.Key, options);
-        return await this.loader.load(bucket, command.input.Key, command.input.Range, command.input.VersionId);
+        const output = await this.loader.load(bucket, command.input.Key, command.input.Range, command.input.VersionId);
+        if (output !== undefined) {
+            return output;
+        }
+        this.authorizer.authorizeMissingKey(bucket, options);
+        throw new SimS3NoSuchKey(`No S3 Object named ${command.input.Key}`);
     }
 }

package/dist/service/s3/command/get-object-tagging/get-object-tagging.command.d.ts

@@ -0,0 +1,29 @@
+import type { SimResponseMetadata } from "../../../aws/metadata/response-metadata.type.js";
+import type { SimS3ObjectTag } from "../../object/s3-object-tags.js";
+/**
+ * Minimal structural sim S3 GetObjectTagging command.
+ */
+export interface SimGetObjectTaggingCommand {
+    readonly input: SimGetObjectTaggingCommandInput;
+}
+/**
+ * Minimal structural sim S3 GetObjectTagging input.
+ */
+export interface SimGetObjectTaggingCommandInput {
+    readonly Bucket?: string | undefined;
+    readonly Key?: string | undefined;
+    /** The version to read. A request naming none reads the current one. */
+    readonly VersionId?: string | undefined;
+}
+/**
+ * Minimal structural sim S3 GetObjectTagging output.
+ *
+ * `TagSet` is always present, and is empty for an Object nobody has tagged.
+ * Real S3 answers an untagged Object with an empty set rather than refusing,
+ * because having no tags is not the same as not existing.
+ */
+export interface SimGetObjectTaggingCommandOutput {
+    readonly TagSet: readonly SimS3ObjectTag[];
+    readonly VersionId?: string | undefined;
+    readonly $metadata: SimResponseMetadata;
+}

package/dist/service/s3/command/get-object-tagging/get-object-tagging.command.js

@@ -0,0 +1 @@
+export {};

package/dist/service/s3/command/get-object-tagging/get-object-tagging.handler.d.ts

@@ -0,0 +1,21 @@
+import type { CommandHandler } from "../../../../command/command-handler.js";
+import { type SimS3ObjectTaggingAccessProperties } from "../tagging/sim-s3-object-tagging-access.js";
+import type { SimS3RequestOptions } from "../sim-s3-request-options.js";
+import type { SimGetObjectTaggingCommand, SimGetObjectTaggingCommandOutput } from "./get-object-tagging.command.js";
+/**
+ * Simulated S3 GetObjectTaggingCommand handler.
+ *
+ * https://docs.aws.amazon.com/AWSJavaScriptSDK/v3/latest/client/s3/command/GetObjectTaggingCommand/
+ */
+export declare class GetObjectTaggingCommandHandler implements CommandHandler<SimGetObjectTaggingCommand, SimGetObjectTaggingCommandOutput> {
+    private readonly access;
+    constructor(properties: SimS3ObjectTaggingAccessProperties);
+    /**
+     * Read the tags on an Object, or on the version the request named.
+     *
+     * An Object nobody has tagged answers with an empty set rather than a
+     * refusal, as real S3 does. Nothing is announced: real S3 raises a tagging
+     * event for a change to the tags, and a read changes nothing.
+     */
+    handle(command: SimGetObjectTaggingCommand, options?: SimS3RequestOptions): Promise<SimGetObjectTaggingCommandOutput>;
+}

package/dist/service/s3/command/get-object-tagging/get-object-tagging.handler.js

@@ -0,0 +1,33 @@
+import { SimS3ObjectTaggingAccess, } from "../tagging/sim-s3-object-tagging-access.js";
+/**
+ * Simulated S3 GetObjectTaggingCommand handler.
+ *
+ * https://docs.aws.amazon.com/AWSJavaScriptSDK/v3/latest/client/s3/command/GetObjectTaggingCommand/
+ */
+export class GetObjectTaggingCommandHandler {
+    access;
+    constructor(properties) {
+        this.access = new SimS3ObjectTaggingAccess(properties);
+    }
+    /**
+     * Read the tags on an Object, or on the version the request named.
+     *
+     * An Object nobody has tagged answers with an empty set rather than a
+     * refusal, as real S3 does. Nothing is announced: real S3 raises a tagging
+     * event for a change to the tags, and a read changes nothing.
+     */
+    async handle(command, options) {
+        const { taggable } = await this.access.reach({
+            commandName: "GetObjectTaggingCommand",
+            action: "s3:GetObjectTagging",
+            input: command.input,
+        }, options);
+        return {
+            TagSet: taggable.tagSet.tags,
+            ...(taggable.versionId !== undefined && {
+                VersionId: taggable.versionId,
+            }),
+            $metadata: {},
+        };
+    }
+}

package/dist/service/s3/command/head-object/head-object-loader.js

@@ -1,5 +1,6 @@
 import { SimS3NotFound } from "../../error/sim-s3.error.js";
 import { simS3QuotedETag } from "../../object/s3-object-etag.js";
+import { simS3ObjectStorageReport } from "../../object/s3-object-storage-report.js";
 import { simS3ReadObjectVersion } from "../object/sim-s3-read-object-version.js";
 /**
  * Describes an authorized S3 Object without reading it out.
@@ -26,6 +27,7 @@ export class HeadObjectLoader {
             ETag: simS3QuotedETag(object.etag),
             LastModified: object.lastModified,
             ...(read.versionId !== undefined && { VersionId: read.versionId }),
+            ...simS3ObjectStorageReport(object),
             ...read.lock?.reported,
             $metadata: {},
         };

package/dist/service/s3/command/head-object/head-object.command.d.ts

@@ -1,5 +1,6 @@
 import type { SimResponseMetadata } from "../../../aws/metadata/response-metadata.type.js";
 import type { SimS3ObjectLockOutput } from "../../bucket/lock/sim-s3-object-lock-output.js";
+import type { SimS3ObjectStorageReport } from "../../object/s3-object-storage-report.js";
 import type { SimS3SystemMetadataOutput } from "../../object/s3-system-metadata-read.js";
 /**
  * Minimal structural sim S3 HeadObject command.
@@ -26,7 +27,7 @@ export interface SimHeadObjectCommandInput {
  * the Object itself, so this is a GetObject output without its body and with
  * the length that body would have had.
  */
-export interface SimHeadObjectCommandOutput extends SimS3SystemMetadataOutput, SimS3ObjectLockOutput {
+export interface SimHeadObjectCommandOutput extends SimS3SystemMetadataOutput, SimS3ObjectLockOutput, SimS3ObjectStorageReport {
     readonly ContentLength?: number;
     readonly Metadata?: Record<string, string>;
     readonly ETag?: string;